antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

[willawake]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

i will try combofix
malwarebytes not clean it

didnt do much manual stuff cos i am fixing it while doing paperwork urgh

somehow i dont think this user would know what is safe mode

[370forlife]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

Try SUPERantispyware, it finds a lot of stuff malwarebytes dosen't.

I ran it on some laptop someone said was being slow. Malwarebytes found 16 infections, SUPERantispyware found 340.

[momaka]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

Make sure you have full acces to System Volume Information before scanning with anything. Viruses and spyware love to hide in that location (or rather Windows loves to make restore points with infected files ). If you get Access Denied message when trying to enter that folder, right-click > Properties > Securiy tab and add the name of the account you wish to add permissions to. Make sure the Full Access box is checked, then click Apply, OK.

[bgavin]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

It exists, it is called Linux....

I don't use it myself, but every time I get a problem with one of my Win boxes, I have a friend that has three Linux boxes and he sings always the same song "Get Linux: It's free, it's fast, it's small, and don't get that problems ...". My answer is "Stop worshiping Linus Torvalds and get a girl!".

That gets old after awhile.
Linux geeks get laid about as often as they reboot.

[willawake]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

i deleted the dll outside windows but i need to remove two reg entries. one is to do with winlogon.

tried combofix.

tried kill winlogon and ssas with process explorer but still cant delete these entries with regedit or combofix or malware. uuuh i want this off my desk.

i think maybe without the dll these are just remnants?

[i4004]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

what about this
http://siri.geekstogo.com/SmitfraudFix.php
?

that it won't let particular regkey may remind of rootkit, right?

any unsolicited traffic you can see with tcpview?

tried all 3 free av programs?

some reading
http://www.bleepingcomputer.com/forums/forum55.html
http://www.bleepingcomputer.com/forums/forum103.html

something else: i would say sometimes damage is probably permanent(ie some important dlls were compromised by virus, and it's hard to get around that), ie you can only install anew. but if machine in is usable state it's better to avoid.

the thing with those hard to remove craps is that you need to search for a particular solution...like searcing some of the symptoms with google and then seeing if anybody else got it and it problem was solved.
or rely on scans, which do take a lot of time.

put avast there once you're done.

[willawake]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

yeah there is definitely something else there. actually i tried superantispyware just before i left the office and it found some .dat. dunno if thats a false positive anyway its a bit more promising than the endless loop i have been in

if it was my own yes i would reinstall at this stage. but this one is a freebie so i want it off my desk asap

i will try smitfraud tomorrow
i have read already lots of bleepingcomputer

[PCBONEZ]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

Try regedit in safe mode and see if that will get those entries.
Doesn't always work, but sometimes.

[bgavin]

Re: antivirus 2009 rouge spyware "antivirus" becoming more aggressive?

You can use a batch file in the RunOnce section in the registry.
This will run, call REGEDIT to delete the key(s) you require, and do so before the rest of Windows starts. This is tool to get rid of stuff you cannot delete once Windows is up far enough for you login.